What is pivoting Study Notes pivoting

Pivoting

Pivoting is a post-exploitation technique where an attacker uses a compromised internal machine (the jump host or pivot point) as a bridge to attack other restricted systems on the network.

Imagine this network:

Attacker ───► Compromised Server ───► Internal Network

The attacker cannot directly reach the internal network for many reasons like:

  • firewalls block access
  • internal machines are private
  • segmentation exists

But the compromised server has access to both the attacker and the internal network. So the attacker turns the compromised machine into a pivot point.

That process is called Pivoting

Another Example:

You
 │
 ▼
Web Server (compromised)
 │
 ▼
Database Server (internal only)

You cannot access the database directly. But the web server can. So you “pivot” through it.

Pivoting Techniques

Pivoting techniques are different ways to route traffic through a compromised machine to reach otherwise inaccessible systems.

1. Local Port Forwarding

Simplest form of pivoting. You forward ONE local port to ONE remote service.

Meaning:

Your localhost:8080
    │
    ▼
Pivot Host
    │
    ▼
10.0.0.5:80

When you visit:

127.0.0.1:8080

connects to:

  • internal host 10.0.0.5
  • port 80

through the pivot host.

Limitation: Only forwards one service/port.

2. Remote Port Forwarding

Opposite direction. The compromised machine exposes a port that forwards back to the attacker.

Internal Machine
      │
      ▼
Pivot Host port 4444
      │
SSH tunnel
      │
      ▼
Attacker port 4444

Useful when inbound access to victim is blocked or victim can only initiate outbound traffic. Common in reverse shells.

3. Dynamic Port Forwarding (SOCKS Pivoting)

Creates a SOCKS proxy. Instead of forwarding one port, forwards arbitrary traffic dynamically

Flow:

Tool
 │
 ▼
SOCKS Proxy
 │
SSH Tunnel
 │
 ▼
Pivot Host
 │
 ▼
Any Internal Target

4. Reverse Dynamic Port Forwarding

5. VPN Pivoting

6. Layer 3 Routing Pivot

True routing pivot. The compromised host routes packets between networks.

echo 1 > /proc/sys/net/ipv4/ip_forward

Then:

  • add routes
  • configure NAT

Now traffic routes normally.

Closest to real router behavior.

8. HTTP/HTTPS Tunneling

9. DNS Tunneling